N8n (< 1.123.76) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/n8n--1.123.76/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 10 Sep 2026 18:53:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDomain-Restriction Bypass in n8n OpenAI Chat Model Nodehttps://feed.craftedsignal.io/briefs/2026-09-n8n-domain-bypass/Thu, 10 Sep 2026 18:53:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-n8n-domain-bypass/An unauthenticated credential access vulnerability in n8n allows users to bypass domain restrictions in the OpenAI Chat Model node via the model-search endpoint, leading to unauthorized credential exposure.A security vulnerability in n8n (CVE-2026-86082) allows authenticated users to bypass configured domain restrictions within the OpenAI Chat Model node. While the primary OpenAI request path correctly validated custom base URLs against allowed-domain configurations, the secondary model-search dropdown endpoint failed to perform this check. An attacker able to manipulate request options could define a custom base URL that directed sensitive requests to an arbitrary, attacker-controlled host while still including the original, valid OpenAI credentials. This flaw enables the exfiltration of API keys or the use of credentials against unauthorized third-party infrastructure. This vulnerability affects multiple versions of n8n across the 1.x and 2.x branches and necessitates a prompt upgrade to the patched versions to ensure consistent credential protection across all API call sites.

Impact

The vulnerability allows unauthorized use of OpenAI credentials by routing requests to external hosts, potentially leading to credential exposure or unauthorized usage of services. If compromised, an attacker can leverage these credentials to make unauthorized API calls. Security teams should assume any n8n instance with domain-restricted OpenAI credentials might have been subject to credential exposure if the instance was accessible to untrusted users prior to patching.

Recommendation

  • Upgrade n8n to version 1.123.76, 2.37.7, 2.38.2, or later to implement centralized domain validation for all OpenAI call sites.
  • Rotate all OpenAI API keys currently stored in n8n instances if there is suspicion of unauthorized access or exposure via this vector.
  • Review OpenAI account usage logs for any traffic originating from unexpected or unauthorized endpoints.
  • Restrict access to the n8n instance to trusted users until the software is patched.
]]>highadvisoryvulnerabilitywebservercredential-theftn8ncve-2026-86082denial-of-serviceweb-vulnerabilitycve-2026-86076javascriptsandbox-escape